diff --git a/.github/buildomat/jobs/check-headers.sh b/.github/buildomat/jobs/check-headers.sh
new file mode 100644
index 000000000..f961c2d7d
--- /dev/null
+++ b/.github/buildomat/jobs/check-headers.sh
@@ -0,0 +1,28 @@
+#!/bin/bash
+#:
+#: name = "header-check"
+#: variety = "basic"
+#: target = "helios-2.0"
+#: rust_toolchain = true
+#:
+
+# Run the various `header-check` tests across Propolis' crates.
+#
+# These tests are run on an illumos target for best fidelity: while the
+# immediate struct and function definitions could in theory be analyzed
+# anywhere, they may contain definitions that vary across target OSes. We must
+# ensure, at a minimum, that FFI definitions are correct w.r.t these headers'
+# interpretation on illumos. Anywhere else is just a convenience.
+
+set -e
+
+GATE_REF="$(./tools/check_headers gate_ref)"
+
+# TODO: `--branch` is overly restrictive, but it's what we've got. In git 2.49
+# the --revision flag was added to `git-clone`, and can clone an arbitrary
+# revision, which is more appropriate here. We might be tracking an arbitrary
+# commit with some changes in illumos-gate that isn't yet merged, after all.
+git clone --depth 1 --branch "$GATE_REF" \
+	https://code.oxide.computer/illumos-gate ./gate_src
+
+./tools/check_headers run ./gate_src
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index c439f89dd..b70fb0e04 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -50,4 +50,3 @@ jobs:
       run: cargo build -p propolis-mock-server --verbose
     - name: Test Libraries
       run: cargo test --lib --verbose
-
diff --git a/Cargo.toml b/Cargo.toml
index cfb47cc3a..a3c16a5ed 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -22,11 +22,14 @@ default-members = [
   "xtask",
 ]
 
+# `header-check` crates are excluded because they require an external checkout
+# of illumos-gate (perhaps even to a specific revision) to run. So, to support
+# more Propolis-local development, exclude these and leave them for more
+# specific tools (see `tools/check_headers`, which is used to run these in CI)
 exclude = [
   "crates/bhyve-api/header-check",
   "crates/nvpair/header-check",
   "crates/viona-api/header-check",
-  "phd-tests/buildomat",
 ]
 
 # If one wants the 'dev' profile, but with "panic = abort" semantics, they
diff --git a/tools/check_headers b/tools/check_headers
new file mode 100755
index 000000000..ee3cbca6d
--- /dev/null
+++ b/tools/check_headers
@@ -0,0 +1,63 @@
+#!/bin/bash
+set -e
+
+# The ref that headers should be checked against.
+#
+# This should almost certainly be `stlouis`, as in the "stlouis" branch in the
+# Oxide fork of illumos. You may want to change this for testing or development
+# if your changes to Propolis track changes in the OS as well.
+#
+# As a default this ref should probably not change.
+HEADER_CHECK_REF="stlouis"
+
+# Directories with `ctest2`-based `header-check` crates. This list should track
+# the similar exclusions in `Cargo.toml`, and are described more there.
+HEADER_CHECK_DIRS=(
+  crates/bhyve-api/header-check/
+  crates/nvpair/header-check/
+  crates/viona-api/header-check/
+)
+
+function usage() {
+  SCRIPTNAME="${0##*/}"
+  echo "usage:"
+  echo "  $SCRIPTNAME run <gate_src_dir>"
+  echo "      run Propolis header-check tests against the provided gate checkout"
+  echo "  $SCRIPTNAME gate_ref"
+  echo "      print the illumos-gate ref headers should be checked against"
+}
+
+function run_checks() {
+  export GATE_SRC="$(readlink -e $1)"
+
+  if ! [ -d "$GATE_SRC" ]; then
+    echo "header-check was given non-existent \"$GATE_SRC\" as gate directory"
+    exit 1
+  fi
+
+  for checkdir in "${HEADER_CHECK_DIRS[@]}"; do
+    echo "RUNNING HEADER-CHECK FOR $checkdir"
+    (cd "$checkdir"; GATE_SRC="$GATE_SRC" cargo test)
+  done
+}
+
+OP="$1"
+
+if [ -z "$1" ]; then
+  usage
+  exit 1;
+fi
+
+case "$OP" in
+  "gate_ref" )
+    echo "$HEADER_CHECK_REF"
+    ;;
+  "run" )
+    GATE_DIR="$2"
+    run_checks "$GATE_DIR"
+    ;;
+  * )
+    usage
+    exit 1
+    ;;
+esac